<!-- Markdown copy of https://insumermodel.com/developers/wdk/ for agents. -->

> A WDK protocol module that adds condition checks before a transaction to any wallet built on Tether's WDK. Signed results, 37 chains. Install from npm.
>
> Page: https://insumermodel.com/developers/wdk/ · API: https://api.insumermodel.com · OpenAPI: https://insumermodel.com/openapi.json · Index for agents: https://insumermodel.com/llms.txt

[Developers](https://insumermodel.com/developers/) / WDK Wallet Auth

@insumermodel/wdk-protocol-wallet-auth @ 0.2.10

# Wallet Auth for Tether's WDK

A protocol module for [tetherto/wdk](https://docs.wdk.tether.io/) that adds pre-transaction, condition-based access. Cryptographically signed attestations and trust profiles, verifiable offline. OAuth proves who you are. Wallet auth proves what you hold.

[npm Package](https://www.npmjs.com/package/@insumermodel/wdk-protocol-wallet-auth) [GitHub](https://github.com/insumerapi/wdk-protocol-wallet-auth) [Read the Announcement](https://insumermodel.com/blog/wdk-protocol-wallet-auth-tether-wallet-development-kit.html)

## The fifth protocol

WDK ships four protocol categories out of the box. We add a fifth, Wallet Auth, as a first-class module alongside them.

### Swap

Velora

### Bridge

USDT0 / LayerZero

### Lending

Aave

### Fiat

MoonPay

### Wallet Auth

InsumerAPI

Each WDK protocol module exposes a typed interface that wallet apps compose into their flow. `SwapProtocol` has `quoteSwap()` and `swap()`. `LendingProtocol` has `supply()`, `borrow()`, `repay()`. `WalletAuthProtocol` has two verbs for the two jobs it does: **attest** an address against a set of on-chain conditions, and produce a signed multi-dimensional **trust** profile. Both are pre-transaction checks. Neither touches private keys.

## Install

```bash
npm install @insumermodel/wdk-protocol-wallet-auth
```

## Attest: signed pass/fail in one call

Evaluate 1–10 on-chain conditions against any address. Returns an ECDSA P-256 signed boolean with a post-quantum signature, with optional ES256 JWT output and EIP-1186 Merkle proofs.

attest():

```javascript
import WalletAuth from '@insumermodel/wdk-protocol-wallet-auth'

const walletAuth = new WalletAuth({ apiKey: process.env.INSUMER_API_KEY })

const { passed, attestation, sig, kid, jwt } = await walletAuth.attest({
  address: '0xCounterparty...',
  conditions: [
    {
      type: 'token_balance',
      contractAddress: '0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48',
      chainId: 1,
      threshold: '1000',
      label: 'USDC >= 1000'
    }
  ],
  jwt: true
})

if (!passed) throw new Error('counterparty failed wallet auth check')
// sig + kid are the audit trail, verifiable offline against the JWKS.
```

## Trust: multi-dimensional profile

155 base checks across stablecoins, governance, NFTs, staking, institutional stablecoins, tokenized treasuries, stablecoin deposits, wrapped bitcoin, names and account code, up to 176 with the optional wallets. Add Solana, XRPL, Bitcoin, or Tron addresses for additional dimensions; Stellar and Sui addresses let the checks on those chains evaluate. The profile is signed as a whole.

trust():

```javascript
const { trust, sig, kid, creditsCharged } = await walletAuth.trust({
  address: '0xd8dA6BF26964aF9D7eEd9e03E53415D37aA96045'
  // optional: solanaAddress, xrplAddress, bitcoinAddress,
  // tronAddress, stellarAddress, suiAddress (each in that chain's format)
})

// trust.id:            TRST-XXXXX profile id
// trust.dimensions:    per-dimension checks
// trust.summary:       totalChecks, totalPassed, totalFailed, totalNotEvaluated, dimensionsWithActivity, dimensionsChecked
```

## Who it's for

Three distinct buyers for a pre-transaction check inside a self-custodial wallet. WDK touches all three.

### Agent wallets

WDK explicitly targets "humans, machines, and AI agents." When an autonomous agent holds keys, the operator wants programmable constraints the agent can't argue its way around, plus a cryptographic audit trail the operator can verify after the fact.

### Consumer apps on WDK rails

Creator-payment tools, remittance apps, treasury products: anything that needs a policy layer between "user clicks send" and "transaction broadcasts." Holdings thresholds, attestations, agent standing. Drop-in, portable attestation format.

### Receive-side trust display

Before accepting an incoming payment, show the sending wallet's trust profile: signed facts about what it holds, dimension by dimension, at the moment it was read. No score, no opinion.

## API surface

| Method | Maps to | Signed | Credits |
|---|---|---|---|
| `attest({ address, conditions, jwt?, merkleProof? })` | [POST /v1/attest](https://insumermodel.com/developers/verification/) | ECDSA P-256 + ML-DSA-65 signature + optional ES256 JWT | 1 (2 with `merkleProof`) |
| `trust({ address, solanaAddress?, xrplAddress?, bitcoinAddress?, tronAddress?, stellarAddress?, suiAddress?, merkleProof? })` | [POST /v1/trust](https://insumermodel.com/developers/trust/) | ECDSA P-256 + ML-DSA-65 signature | 3 (6 with `merkleProof`) |

## Verification

Every result carries a signature (`sig`) and key ID (`kid`) that let any party verify the result offline, without calling the API, against the public JWKS:

```
https://insumermodel.com/.well-known/jwks.json
```

Use any standard JOSE or JWT library, or `npm install insumer-verify` (`pip install insumer-verify` in Python) for a convenience wrapper. If you request `jwt: true` on `attest()`, the output is also a standard ES256 JWT: Kong, Nginx, Cloudflare Access, and AWS API Gateway can verify it the same way they verify any other JWT.

## Supported chains

InsumerAPI covers **37 chains**: 31 EVM networks (Ethereum, Polygon, Arbitrum, Optimism, Base, Avalanche, BNB, XDC, and the full major-EVM set), plus Solana, XRPL, Bitcoin, Tron, Stellar, and Sui. The module works today on every WDK surface that overlaps: `wdk-wallet-evm`, `wdk-wallet-solana`, `wdk-wallet-btc`, and `wdk-wallet-tron`. It also covers XRPL, Stellar, and Sui, which have no WDK wallet module.

**Not yet covered**: TON and Lightning/Spark. Apps on those WDK runtimes can still call `attest()` or `trust()` against any EVM, Solana, Bitcoin, XRPL, Tron, Stellar, or Sui address the user holds. Multi-chain addresses (`solanaAddress`, `xrplAddress`, `bitcoinAddress`, `tronAddress`, `stellarAddress`, `suiAddress`) are routed automatically based on each condition’s `chainId`.

## Buying credits

Free tier ships **10 attestation credits** on every new key: enough to run the module end-to-end before spending anything. When a wallet app needs more, credits are purchased on-chain via `POST /v1/credits/buy`: no Stripe, no fiat. Supported rails: **USDC or USDT** on Ethereum, Base, Polygon, Arbitrum, Optimism, BNB Chain, and Avalanche (auto-detected from the transaction), **USDC or USDT** on Solana, **USDT** on Tron, or **BTC** on Bitcoin. Submit the transaction hash and the credits are added once the transfer is verified on-chain.

## Runtimes

Node.js ≥ 18 (uses built-in `fetch`), Bare Kit and React Native (pass a `fetch` override in the constructor), and browsers (CORS is enabled on `api.insumermodel.com`). The module is ESM-only and ships with no runtime dependencies.

## Ready to ship?

`npm install @insumermodel/wdk-protocol-wallet-auth`, then get a free API key with 10 credits.

[Get an API Key](https://insumermodel.com/developers/api-reference/) [View Source on GitHub](https://github.com/insumerapi/wdk-protocol-wallet-auth)